Privacy policy

1. Controller and contact

Controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR): [name of the operator: to be added], [postal address: to be added]. Full provider details: legal notice.

Privacy requests and questions: kontakt@blockmetric.io. We have not appointed a data protection officer.

2. Overview

• No advertising trackers, no third-party analytics and no third-party content loaded into your browser (fonts come from our own server).
• Only strictly necessary cookies (section 5); page views are counted without cookies and only as totals (section 4).
• We do not sell personal data, do not use it for advertising and do not build profiles.

3. Hosting, content delivery and server logs

Our server runs at Amazon Web Services (AWS) in the region Tokyo, Japan. Every request to our domain first passes Cloudflare, which resolves the domain, encrypts the connection (TLS), delivers cached public pages and filters attacks; Cloudflare processes your IP address and the request data (time, URL, referrer, browser and device information) for this. Both act as our processors under a data processing agreement (Art. 28 GDPR).

Our server keeps an access log with the time, requested address, status and browser, but your IP address shortened to its first three blocks (IPv4 /24) or to /48 (IPv6), with query strings, cookies and access keys removed; it is deleted after 7 days. Application logs contain no e-mail addresses, IP addresses or tokens and are deleted after 30 days. For rate limiting, IP addresses are hashed and kept in memory only for the length of the time window. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in delivering a secure, working website and preventing abuse).

4. Page-view counts without cookies

To see which pages are used, your browser sends the page path, the referring page and, if present, the campaign parameters utm_source/utm_campaign to our own server when you change pages. We store only counters per day, page, referring domain, campaign parameters and device class (mobile, tablet, desktop). We do not store IP addresses, user agents, cookies or any identifier; a counter cannot be linked to a person or a visit. No cookies are set or read and nothing is stored on your device. Nothing is counted when your browser sends Do Not Track or Global Privacy Control. Account pages, login links and internal areas are never counted. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data-minimising audience measurement). The aggregated counters are kept for up to 400 days.

5. Cookies and local storage

We only use cookies and browser storage that are strictly necessary for a service you asked for (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG); no consent banner is needed for them. There are no marketing or analytics cookies.

If Cloudflare's protection asks your browser to pass a security check, Cloudflare sets a cookie that records the passed check, so that it is not repeated on every page.

Local storage in your browser (never sent to us automatically): chart settings (for example heatmap:prefs), recently viewed coins (recentCoins), the code language chosen in the docs (bm.docs.lang), the newest news item you have seen (to mark new ones) and, without an account, your watchlist (bm_watch_v1). You can delete cookies and local storage at any time in your browser settings.

6. Account

For an account we store name, e-mail address, a password hash (scrypt), sign-up and confirmation times and failed-login counters to lock out attacks. Sign-ups that are never confirmed are deleted after 7 days. A login lasts 30 days, is extended while you use it and ends at the latest 180 days after you logged in; expired sessions and used or expired confirmation and password links are deleted automatically. Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) GDPR (security).

You can turn on two-factor login (TOTP): we store the secret for your authenticator app encrypted and the recovery codes only as hashes. For the list of your logged-in devices we store a coarse device label per session (browser and operating system, no IP address). Your notification settings (mute, quiet hours with time zone, digest, unsubscribe from alert e-mails) and watchlists are stored with your account until you delete it. On account → privacy & data you can download all data of your account as JSON (Art. 15 and 20 GDPR) and delete your account yourself (Art. 17 GDPR).

7. Subscriptions and payment

Subscriptions cannot be bought online at the moment, so no payment provider receives data for them; the provider will be named here before sales open. You enter payment details directly with the provider; we receive plan, status, term and a customer id, never your card or bank details. Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (statutory retention of tax and accounting records).

The free trial and the money-back guarantee are once per account: for that we keep a one-way hash (SHA-256) of the normalised e-mail address of every account that had a subscription or used the guarantee, and of the card fingerprint of a trial, never the address or card itself. These hashes are kept after an account is deleted, so a new account with the same address cannot repeat them. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse of these offers).

Business orders of Blockmetric RPC additionally store the company name, country, VAT ID (if you enter it) and the time you confirmed that you order as a business. Legal basis: Art. 6(1)(b) and (c) GDPR.

Legal records

To prove what was declared and confirmed, we keep three kinds of records: cancellations and withdrawals (also those sent without login on /cancel and /withdraw: the e-mail address, name, reason or note and reference you enter, the time of receipt, the matched contract and the status of the confirmation e-mail), the consent you give in the order overview before payment (the exact wording shown, its version and the time) and order confirmations (order number, plan, term and the time). Legal basis: Art. 6(1)(c) GDPR (confirmation and documentation duties for cancellations, withdrawals and contracts, §§ 312f, 312k and 356a of the German Civil Code, BGB) and Art. 6(1)(f) GDPR (legitimate interest in being able to prove these declarations). These records are kept until the end of the regular limitation period (three years from the end of the year in which they were made) and then deleted automatically. Deleting your account does not delete them earlier, because they are needed to establish, exercise or defend legal claims (Art. 17(3)(e) GDPR); they are included in your data download.

8. E-mails

We send e-mails you need for the service (account confirmation, password reset, alerts you set up, renewal and trial reminders, order and cancellation confirmations) on the basis of Art. 6(1)(b) GDPR. They are sent through Amazon Simple Email Service in the AWS region Tokyo, Japan. E-mails you send to our addresses are received by Cloudflare Email Routing and forwarded to our mailbox ([mailbox provider: to be added]); we use them only to answer you and keep them as long as the matter requires, or as long as commercial and tax law requires for business letters. Legal basis: Art. 6(1)(b) or (f) GDPR.

Newsletter (weekly report)

If you subscribe to the newsletter, we store your e-mail address with the status of your subscription, the exact consent text shown next to the form (and its version), the time of sign-up and the time you confirmed. We use double opt-in: you first receive a confirmation link (valid 48 hours, stored only as a hash), and nothing is sent until you click it. We do not store your IP address. Legal basis: Art. 6(1)(a) GDPR (consent); the stored consent record serves as proof (Art. 7(1) GDPR). Every newsletter contains an unsubscribe link, and mail programs can unsubscribe with one click (/api/newsletter/unsubscribe); you can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR). After unsubscribing we keep the address with the time of unsubscribing so we do not write to you again.

Watchlist e-mail

With an account you can switch on a weekly e-mail about your watchlist (opt-in in your account settings, off by default). We store the setting, the last week sent and, if you unsubscribe, the time. Each e-mail has an unsubscribe link. Legal basis: Art. 6(1)(b) GDPR (a function you switched on).

9. Alerts, API and webhooks

For alerts we store your rules, delivery channels and a delivery log (kept 365 days, the longest alert log a plan shows). For Telegram we store the chat id after you link a chat, and for Telegram groups or channels you connect their chat id, title and who linked them. Messages are delivered through Telegram, e-mail or your own alert webhook, as you choose.

For API keys we store a keyed hash of the key (never the key itself), its prefix and last four characters, the name, expiry and IP allowlist you set, and usage counters per day (kept 400 days). To show where a key was last used and to warn you about use from a new network (if you switch this on), we store the network a key was used from, shortened to the first three blocks of an IPv4 address (/24) or an IPv6 /48 (never the full address), with the times of first and last use, for at most 20 networks per key; entries unused for 90 days are deleted, and all of them with the key. For webhooks we store the endpoint URL you enter, an encrypted signing secret and a delivery log (kept 30 days). Legal basis: Art. 6(1)(b) GDPR, and for the network entries Art. 6(1)(f) GDPR (legitimate interest in protecting your account and keys against misuse).

10. Telegram bot and channel

Our Telegram bot answers the commands you send it. For a chat that is not linked to an account we store nothing but the number of each incoming message for 2 days, so that no message is processed twice; the one-time code that connects a chat to your account is deleted one day after it expires. Our public Telegram channel only posts; we keep no data about its subscribers in our systems. Telegram itself processes your use of the bot and the channel under its own privacy policy. Legal basis: Art. 6(1)(b) GDPR (answering your requests) and Art. 6(1)(f) GDPR (reliable processing).

11. Blockmetric RPC

For RPC endpoint tokens we store a keyed hash of the token (never the token itself), its prefix and last four characters, and the name, chains, allowed origins and IP allowlist you set. Our gateway does not store request bodies or parameters (so no wallet addresses from your calls) and never logs signed transactions. We keep counters per account, chain, method and day (credits, requests, errors, latency ranges) for 400 days, requests per minute for 26 hours, and recent errors (time, chain, method, error code) for 7 days. The access log of the RPC gateway holds the time, chain, status and your IP address shortened to /24 (IPv4) or /48 (IPv6) for 7 days; the network a token was last used from is stored in the same shortened form. To keep Blockmetric RPC out of countries and regions under EU sanctions, the gateway checks the country and region that Cloudflare derives from your IP address. Your RPC requests are forwarded to the infrastructure providers that run the blockchain nodes; they see our gateway's address, not yours. Legal basis: Art. 6(1)(b) GDPR (providing the service you use), Art. 6(1)(c) GDPR (sanctions law) and Art. 6(1)(f) GDPR (security and abuse prevention).

RPC waitlist: if you join it, we store your e-mail address, company, chains, expected volume, use case and the exact consent text with its time. You only stay on the list after confirming the link in our e-mail (double opt-in); unconfirmed entries are deleted after 30 days. We e-mail you when the options you asked for open; every e-mail has a one-click unsubscribe link, which removes your details and keeps only the fact and time of the opt-out. Legal basis: Art. 6(1)(a) GDPR (your consent, which you can withdraw at any time).

12. Contact forms and data reports

Messages sent with the contact form or the enterprise contact form (name, e-mail address, topic, text) are e-mailed to our address (section 8) and not stored in our database. Legal basis: Art. 6(1)(b) GDPR where your message concerns a contract or its preparation, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

Report incorrect data: we store the page the report is about, your message and (only if you enter it, so that we can answer) your e-mail address, together with the time and whether we have handled it. We do not store your IP address; the form is rate-limited in memory only. Reports are only visible to us and are not published. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in correct data).

13. Wallet pages and public blockchain data

Wallet and address pages show publicly visible on-chain and exchange data. The wallet check sends the address you enter from our server to Hyperliquid's public API; the address you type is not stored with your visit. Names that public leaderboards show for an address are stored only after removing anything that looks like an e-mail address, phone number or link. Wallet addresses can be personal data; legal basis: Art. 6(1)(f) GDPR (legitimate interest in transparent market information). Some wallets carry a name that public reports (news articles and on-chain research publications) associate with the address; each such label keeps its source, which the wallet page links, and is marked as reported. You can object to an address being shown (Art. 21 GDPR, section 17).

14. Recipients

We pass data to authorities only where we are legally obliged to.

15. Transfers outside the EU

Our server and our e-mail sending run in Japan. For Japan the European Commission has adopted an adequacy decision (Art. 45 GDPR, Implementing Decision (EU) 2019/419). Amazon Web Services and Cloudflare are US companies, and Cloudflare processes requests in data centres worldwide. Transfers to the USA are based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Where you choose Telegram as a channel, the transfer is necessary to deliver the alerts you asked for (Art. 49(1)(b) GDPR).

16. Retention

We delete personal data as soon as it is no longer needed for its purpose, unless the law requires us to keep it; the period for each kind of data is stated in its section above. The database is backed up daily on our server and the last 3 backups are kept, so deleted data disappears from the backups after 3 days at the latest. Invoices and accounting records are kept for the statutory periods (up to 10 years under German tax and commercial law) by us or the payment provider.

17. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw any consent with effect for the future (Art. 7(3)). Write to the address in section 1; most of it you can also do yourself on account → privacy & data.

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We then stop unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

18. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement. The authority competent for us: [competent supervisory authority: to be added].

19. Automated decisions and obligation to provide data

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. You are not obliged to provide personal data; without an e-mail address, however, we cannot open an account or deliver e-mail alerts.

20. Security

Connections are encrypted (TLS) all the way to our server, and the server accepts web traffic only through Cloudflare. Passwords are stored as scrypt hashes, API keys and RPC tokens as keyed hashes; two-factor secrets and webhook signing secrets are stored encrypted. Administrative access to the server requires a cryptographic key.

21. Changes to this policy

We update this policy when our processing changes. The date at the top shows the current version.